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FEDERAL BUREAU OF INVESTIGATION 


Date of entry 01/21/2015 





was interviewed at a coffee shop in San Francisco, California. After being 
advised of the identity of the interviewing Agent and the nature of the 
interview,[ ___] provided the following information: 























[| provided s short summary of the company. NTT is a hosting 
provider. It's business address is 9120 Double Diamond Parkway, Suite 5901, 
Reno, Nevada, 89521. NTT's servers are hosted at 200 Paul Avenue, San 
Francisco, California, 94124. At its peak last year, NTT employed 
approximately 20 people but now only employ 3 due to a large layoff period. 





NTT runs approximately 200 servers at its data center. 





Its largest customer is a discussion board called 2channel (2CH) geared 


for the population of Japan. It uses approximately 30 of NTT's servers. 


of 2CH was a partnership 
A recent falling out 


who went to college in Arkansas. The hosin 
between the 
in 2012-2013 between 


NTT has a block of IP addresses for its 2CH servers. 







Another large customer of NTT is a image board called 8channel (8CH). 
8CH, using domain 8ch.co, was the result of a migration of many users from 
the old 4channel board. Although 8CH has many different discussion topics, 
it is more widely known to be hosting a discussion of a gaming controversy 
where gamers were protesting against game developers of trying to rip-off 
game players. NTT has several IP addresses designated to 8CH servers. One 


of NTT's IP addresses for 8CH was 206.223.150.25. 
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Beginning on or about 01/06/2015,______]was notified by a 2CH b6 
b7C 





administrator that there was no service to 2CH. [| quickly learned that 
2CH was experiencing a large DDoS attack. NTT's routers were so overwhelmed 





with traffic that initial logging could not be done. NTT had to replace the 











router with a faster router in order to monitor traffic and to get some 














network functionality. Bandwidth graphs indicated sustained traffic ranging 











between 4 Gb/s to 20 Gb/s during the time period. NTT was able to gain 
limited functionality at times but the attack was just too overwhelming to 




















be serviceable. 


The attack was finally mitigated in the early morning of 01/15/2015 when 
their upstream providers GTT and Cogent null-routed the targeted NTT IP 
addresses. The targeted IP addresses NTT identified so far against 2CH were 
206.223.153.32 and 206.223.153.163. 





There is a intermediate upstream provider between GTT/Cogent and NTT 
called Centauri which ultimately provides the immediate bandwidth to NTT. 


[ ] speculated that the Japanese posting (written in Japanese) b6 
b7c 





demanding payment could have been the one who hired Lizard Squad but 
could not prove it. To date, NTT suffered approximately $50,000 dollars in 





damage. That loss figures included the price of the router they had to 
purchase to get some kind of functionality and generate pcap files for 
analysis. 


When asked if he knew of anyone who had any motivation to target NTT or 


its 2CH board,[___Jreplied that he would not be surprised it _—__  ] b6 


was behind the attack. and had the financial bic 
means to do it because was a millionaire. 


b7C 








forum data routed to a data company called HOTTOLINK without anyone at NTT 
know. HOTTOLINK paidL_—sd for the data. When NTT cut the link, 
HOTTOLINK stock price plummeted, implying 2CH data was their biggest data 
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Continuation of FD-302 of 01/16/2015 , On 01/16/2015 , Page 3 of 3 
source. had made attempts to start a competitor to 2CH. It would 
not surprise that[ could lure current 2CH users to a new 











forum board because the service at 2CH was unreliable. 





Another person who would have motivation was a former employee named 


[ ] ak _____— č J]vwas one of those laid off from NTT and 


who was found to be taking NTT customer data to lure customers away in 

















order to start a competing business. 
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